NBC4 talks to Ohio group investigating ransomware attack

COLUMBUS, Ohio (WCMH) -- Columbus is five weeks out from a ransomware attack that led to thousands of people’s private, personal information on the dark web, and NBC4 Investigates is digging into what happened and how.

The city is getting help from the FBI, outside law firms and, as Mayor Andrew Ginther confirmed Saturday, the state level. The city asked for the Ohio Cyber Reserve’s help on July 31.

This team has three missions, and the help Columbus needs falls right in line with what they do.

The reserve said they stay busy with the first two missions -- assess and educate -- to keep down requests for their third mission: incident response. However, they said they are seeing an uptick this year in entities requesting help after a cyber attack.

The Ohio Cyber Reserve was authorized by Governor Mike DeWine in 2019. It is a team of almost 180 volunteers.

"The team is a very diverse background from every walk of life and every different industry that you can imagine," Ohio Cyber Reserve Deputy Regional Commander Duane Powell said. "We have people that support critical infrastructure for their day jobs. We have people in local government and state government. We have people that support the DOD and the federal infrastructure."

While the reserve helps school districts, critical infrastructure, and state and local governments when there is a cyber attack, they also help educate the current and future workforce.

"The 'educate' mission is all about preparing the next generation of cyber professionals to enter the field and understand the field that they're entering," Powell said. "The assist mission is all about going out to our task organizations and helping them understand where they are with their current infrastructure towards an industry standard and how maybe better to close any gaps that they might have." 

"We'll do K through 12. If they have a science day, we'll have a cybersecurity piece there," Ohio Cyber Reserve Program Administrator Craig Baker said. "We'll help out camps. We do a lot of work at the Wright Patt Air Force Museum. We also do a lot of seminars for I.T. Departments around the state. We've literally done hundreds of these seminars."

Columbus’ Department of Technology asked for the Ohio Cyber Reserve on July 31. The reserve signs a non-disclosure agreement, so only the city can speak to how they helped.

"A big part of the Ohio Cyber Reserve is the trust that we have with the organizations that we serve. And so we will not comment on any specific incident that we are a part of. That is up to the organization that requested us to comment or discuss any of the specifics," Powell said. 

NBC4 Investigates spoke with them about the work they do in general.

"Typically a request goes to the Emergency Management Association and then that process filters through eventually to the governor, who has to put us on state active duty," Powell said. "And then Major General John Harris makes the call and sends us out."

Once a request is put in, the team tries to get as much information as possible, forms the team based on the request and then mobilizes, a process that can be as quick as a few hours. 

The goal is to regain control of the systems. They go through every device they are tasked with to figure out where the threat actor was, if they were there and if they have left.

"There's never really a time limit, but we do try to work as quickly as possible to regain control for the entity and then we leave," Powell said. 

Powell said the team typically hands a report to the organization after around a week. NBC4 asked the city how long the Ohio Cyber Reserve has been helping Columbus.

"They were brought in to support our investigation, but we are unable to discuss this ongoing investigation into a criminal act against the city," a city spokesperson said in a statement to NBC4.

Ohio’s team has helped other states start similar programs - it’s a way for qualifying entities to protect themselves in an age where many of the threats we face are online.

"A lot of these municipalities can't afford to go to the to the companies that do this professionally," Baker said. "The smaller organizations, it's a big help for them, especially the education piece. Again, because the seminar, you know, you're going to be paying $3,000 to $5000 for a weeklong seminar, but they come to us it’s for free."

NBC4 also asked for an interview with the mayor and the director of technology. Neither had time, but we were given a statement from a city spokesperson that said: "Our team is continuing working around the clock to restore all city functions, to be as transparent as possible amid an active criminal investigation and do everything in our power to protect our residents."